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TUNABLE ARCHITECTURE FOR AIRCRAFT 
FAULT DETECTION 

GOVERNMENT INTEREST STATEMENT 

5 

The invention described herein was made in the perfor- 
mance of work under NASA Contract No. NAS 1-00 107 and 
is subject to the provisions of Section 305 of the National 
Aeronautics and Space Act of 1958 (42 U.S.C. 2457). 

BACKGROUND 10 

Fast and reliable failure detection is crucial for damaged 
aircraft to maintain controlled flight. The two main objectives 
of the U.S. Government’s Aviation Safety Program are to 
develop and demonstrate technologies that reduce aircraft 15 
accident rates, and develop technologies that reduce aviation 
injuries and fatalities when accidents do occur. Fault detec- 
tion, isolation, and reconfiguration (FDIR) for flight control 
continues to be an active area of research in the aerospace 
community. To date, a wide variety of technologies have been 20 
demonstrated in high-fidelity simulations (that is, simulations 
with minimal distortions) and in actual flight tests with vari- 
ous levels of success. 

For model-based aircraft fault detection, a mathematical 
model of the aircraft is used. Model-based fault detection is 2 5 
based on comparing measurements from the aircraft with 
corresponding error predictions from the aircraft model (that 
is, residual processing). In real life situations, the comparison 
of these signals is not trivial. This is due to the fact that 
(typically) there are imperfections in most mathematical 
flight simulation models coinciding with multiple sources of 30 
aircraft measurements errors. Therefore, any fault detection 
algorithms require fast and reliable processing in the presence 
of modeling and measurement errors. 

SUMMARY 35 

The following specification addresses an architecture and 
tuning procedure for aircraft fault detection. Particularly, in 
one embodiment, a method for detecting faults in an aircraft 
is provided. The method involves predicting at least one state 40 
of the aircraft and tuning at least one threshold value to tightly 
upper bound the size of a mismatch between the at least one 
predicted state and a corresponding actual state of the non- 
faulted aircraft. If the mismatch between the at least one 
predicted state and the corresponding actual state is greater 45 
than or equal to the at least one threshold value, the method 
indicates that at least one fault has been detected. 

DRAWINGS 

These and other features, aspects, and advantages will 50 
become better understood with regard to the following 
description, appended claims, and accompanying drawings 
where: 

FIG. 1 is an illustration of an embodiment of a flight sys- 
tem; 55 

FIG. 2 is a block diagram of an embodiment of a flight deck 
control model; and 

FIG. 3 is a block diagram of an embodiment of a fault 
detection module within the flight deck control model of FIG. 

2. 60 

Like reference numbers and designations in the various 
drawings indicate like elements. 

DETAILED DESCRIPTION 

65 

FIG. 1 is an illustration of an embodiment of a flight system 
100. The flight system 100 comprises an aircraft 104 and a 


2 

flight deck 106. For the purposes of this description, FIG. 1 
includes an airport 102. The airport 102 is representative of a 
typical airport with a runway suitable for takeoffs and land- 
ings of the aircraft 104. The flight deck 106 is responsible for 
activating and monitoring flight controls for the aircraft 104. 
The aircraft 104 is shown by way of example and not by way 
of limitation. In one embodiment, the aircraft 104 is repre- 
sentative of a typical aircraft (for example, a twin-engine 
transport aircraft, or the like) with longitudinal and lateral/ 
directional axes control surfaces. In the example embodiment 
of FIG. 1, the plurality of control surfaces comprise, without 
limitation, elevators 1 10 x and 110 2 and a stabilizer 112 for 
longitudinal -axis control of the aircraft 104. Additional con- 
trol surfaces of the aircraft 104 include, without limitation, 
ailerons 114 : and 114 2 , a rudder 116, flaps 1^ and 118 2 , 
slats 120 : and 120 2 , and spoilers 122 : and 122 2 to provide 
lateral/directional control of the aircraft 104. The aircraft 104 
further includes, without limitation, engines 124 1 and 124 2 , 
and landing gear 126 . It is further understood that the arrange- 
ment of the plurality of control surfaces on the aircraft 104 as 
shown in FIG. 1 is one example of an acceptable arrangement, 
and that other arrangements are possible. 

The flight deck 106 further includes a flight display 108. In 
the example embodiment of FIG. 1, the flight display 108 is a 
version of a flight display for a Control Upset Prevention and 
Recovery System (CUPRSys), or the like, that simulates air- 
craft failure prevention and recovery on a plurality of civilian, 
commercial or military aircraft. In one implementation, the 
flight display 108 displays, without limitation, angular accel- 
eration of the aircraft 104 and pitch, roll and yaw of the 
aircraft 104 with respect to a rotating earth. The flight display 
108 further indicates, without limitation, effects of current 
control surface positions (of the plurality of control surfaces 
discussed above, including the landing gear 126) on the aero- 
dynamics of the aircraft 104. Additional aircraft state infor- 
mation provided by the flight display 108 includes, without 
limitation, performance of engines 124 1 and 124 2 , landing 
gear 126, and current atmosphere and turbulence measure- 
ments. In the example embodiment of FIG. 1, any potential 
aircraft fault of the aircraft 104 are visually displayed in the 
flight deck 106 by the flight display 108. In one implementa- 
tion, potential aircraft faults include, without limitation, stuck 
and floating flight control surfaces due to a hydraulic or 
mechanical malfunction, reduced surface effectiveness due to 
a surface loss, an engine failure, a landing gear failure, and a 
buildup of ice on one or more flight control surfaces. 

A simulated model of the aircraft 104 includes a tunable 
architecture for aircraft fault detection such as further 
described, for example, with respect to FIG. 3 below. The 
tunable architecture for aircraft fault detection will substan- 
tially minimize (that is, reduce) the number of false alarms 
(due to any mismatches in actual aircraft states versus pre- 
dicted aircraft states of the aircraft 104) while maintaining a 
required level of fault detection. The simulated model of the 
aircraft 104 (discussed below with respect to FIG. 2) is con- 
cerned with detecting faults (that is, equivalent aircraft-to- 
model mismatches) for proper flight deck control in the flight 
deck 106 during an actual flight. 

FIG. 2 is a block diagram of an embodiment of a flight deck 
control model 200. In the example embodiment of FIG. 2, the 
flight deck control model 200 is a flight control simulation of 
the aircraft 104 of FIG. 1. The flight deck control model 200 
ftirther comprises a control subsystem 202 , a flight command 
block 204, a flight measurement block 206, and a flight simu- 
lation block 214. The control subsystem 202 further includes 
a control law block 208, a fault isolation block 209, a fault 
detection block 210, and a flight display block 212. Both the 
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flight command block 204 and the flight measurement block 
206 are in communication with the control law block 208 and 
the fault detection block 210. The fault isolation block 209 is 
in communication with the control law block 208. The fault 
detection block 210 is in communication with the fault isola- 
tion block 209 and the flight display block 212. The flight 
display block 212 is representative of the flight display 108 of 
FIG. 1. 

In one implementation, the flight command block 204 rep- 
resents flight commands received from an operator (pilot) 
navigating the aircraft 104 of FIG. 1. Moreover, the flight 
simulation block 214 represents the aircraft 104. The flight 
simulation block 214 continuously issues one or more simu- 
lated control surface position sensor outputs and one or more 
aircraft state outputs to the flight measurement block 206 . The 
flight measurement block 206 predicts at least one aircraft 
state of the flight simulation block 214. The flight deck con- 
trol model 200 models operational behavior of the flight 
simulation block 214 so that any mismatch is reduced in 
actual movements versus predicted movements of the non- 
faulted aircraft model block 214. The flight deck control 
model 200 reconfigures control of the flight deck 106 in 
real-time based on a tunable fault detection algorithm and a 
fault isolation algorithm. The tunable fault detection algo- 
rithm is described further below in connection with FIG. 3. 
By incorporating the tunable fault detection algorithm, the 
flight deck control model 200 maintains a required level of 
fault detection for at least the aircraft faults discussed above 
with respect to FIG. 1. 

In operation, the control law block 208 and fault detection 
block 210 receive one or more flight commands from the 
flight command block 204. The control law block 208 and 
fault detection block 210 receive one or more aircraft state 
measurements from the flight measurement block 206. The 
control law block 208 controls one or more positions of the 
plurality of flight control surfaces discussed above with 
respect to FIG. 1. To accomplish this, the control law block 
208 receives one or more input commands from the flight 
command block 204 and the flight measurement block 206. 
The one or more input commands include, without limitation, 
a roll rate (p), a blend of pitch rate and normal acceleration 
(C*), and an angle-of-sideslip ((3). From the one or more input 
commands received, the control law block 208 issues one or 
more flight control surface commands to the flight simulation 
block 214. The one or more flight control surface commands 
include, without limitation, an aileron difference between the 
ailerons 114! and 114 2 of FIG. 1, an average elevator for the 
elevators 110 1 and 110 2 of FIG. 1, and the rudder 116 of the 
aircraft 104 . In one implementation, the control law block 208 
generates roll, pitch, and yaw commands based on the one or 
more aircraft state measurements from the flight measure- 
ment block 206. The control law block 208 allocates at least 
one flight control surface command for every corresponding 
flight control surface on the aircraft model block 214. 

The fault detection block 210 models non-linear equations 
of motion of the aircraft 104 through a constant matrix H M 
(the control law block 208 uses the same model structure with 
a different constant matrix H c ). In one implementation, the 
fault isolation block 209 estimates the change in H M (AH^) 
for every fault that the fault detection block 210 detects using 
a recursive least squares (RLS) estimator. The RLS estimator 
receives a processed state of the aircraft 104, one or more 
control surface position measurements of the aircraft 1 04, and 
one or more angular accelerations of the aircraft 104 from the 
fault detection block 210. The fault isolation block 209 iso- 
lates at least one fault when the estimate of AH M converges. 


4 

Once the at least one fault is isolated, the fault isolation block 
209 updates the control law block 208 with a reconfigured 
control law (that is, reconfigures the H c if matrix). At sub- 
stantially the same time, the pilot display block 212 notifies 
5 the flight display 108 of FIG. 1 with a status and potential 
impact of the at least one detected fault on the aircraft 104. 

From the aircraft state measurements and the one or more 
flight control surface position measurements, the flight mea- 
surement block 206 predicts (that is, estimates) angular accel- 
io eration of the aircraft 1 04 in all three axes (that is, the x, y and 
z axes). The fault detection block 210 determines a difference 
(that is, an error) between measured and estimated angular 
accelerations to produce a residual signal (as further dis- 
cussed in detail below with respect to FIG. 3). The residual 
1 5 signal is subsequently compared to a fault detection threshold 
within the fault detection block 210. When the residual signal 
is greater than the fault detection threshold, a fault is flagged 
on the flight display block 212. As further discussed in detail 
below with respect to FIG. 3, the fault detection block 210 
20 tightly bounds one or more differences between predicted 
states and actual states of the non-faulted aircraft 104. The 
fault detection block 210 is further responsible for substan- 
tially minimizing missed fault detections and reducing false 
alarms. To substantially minimize and reduce false alarms 
25 due to wind gusts, the fault detection threshold within the 
fault detection block 210 is also made a function of measured 
linear accelerations. 

FIG. 3 is a block diagram of an embodiment of a fault 
detection module 3 00 within the flight deck simulation model 
30 of FIG. 2. In the example embodiment of FIG. 3, the fault 
detection module 300 is further representative of the fault 
detection block 210 of FIG. 2 discussed above. The fault 
detection module 300 comprises a threshold function 302, an 
error function 303, and a residual band pass filter 304. The 
35 threshold function 302 further comprises absolute measure- 
ment functions 306 : to 306 3 , threshold filter functions 308 x to 
308., bias model blocks 310 1 to 310 3 , threshold summation 
points 312 x to 312 3 , and a threshold signal multiplexer 326. 
The residual band pass filter 304 comprises a low pass filter 
40 function 320, a high pass filter function 322, and a residual 
signal multiplexer 324. The residual signal multiplexer 324 
issues a residual signal 332 to a comparator function 328. The 
comparator function 328 computes a fault signal 334 as a 
potential fault detection signal for the flight display block 212 
45 of FIG. 2. 

The threshold function 302 accepts at least three reference 
commands (indicated as r : to r 3 in FIG. 3) from the flight 
command block 204 of FIG. 2. The threshold function 302 
transfers each of the at least three reference commands r 1 to r 3 
50 to corresponding absolute measurement functions 306 x to 
306 3 and threshold filter functions 3 08 x to 308 3 for each axis 
of motion. Each threshold summation point 312! to 312 3 
receives an output from the corresponding threshold filter 
function 3 08 x to 308 . and at least one bias value from corre- 
55 sponding bias model blocks 310! to 310 3 . Each bias model 
block 310 compensates (accommodates) for one or more 
external (unmeasured) disturbances (for example, atmo- 
spheric turbulence) on each axis of motion. The threshold 
signal multiplexer 326 issues a threshold signal 330 to the 
60 comparator function 328. 

The error function 303 comprises an aircraft model block 
314 and a selector block 316 coupled to a differencer 318. The 
aircraft model block 314 receives one or more control surface 
positions and one or more actual aircraft states from the flight 
65 measurement block 206 of FIG. 2. The selector block 316 
receives the one or more actual aircraft states from the flight 
measurement block 206. The aircraft model block 314 deter- 
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mines an estimated angular acceleration of the aircraft 104 

(indicated as oo in FIG. 3). The selector block 316 derives a 
measured angular acceleration of the aircraft 104 (indicated 
as oo m in FIG. 3) from the one or more actual aircraft states 
(indicated as % in FIG. 3). As further illustrated below, the 5 
differencer 318 differences the estimated angular accelera- 
tion and the measured angular acceleration of the aircraft 104 
in all three axes of motion to produce error signals e 1 to e 3 . 
The residual band pass filter 304 filters the error signals e : to 
e 3 from the error function 303 to remove control surface trim 1C 
and measurement errors, creating the residual signal 332. 


Error Processing of Measured vs. Estimated Aircraft 
States 

15 

A model of the one or more aircraft states from the flight 
measurement block 206 of FIG. 2 is illustrated below in 
Equation 1. 

x=Jlx,u), (i>=Cx~^ (ti=Cf(x,u) (Equation 1) 20 

With respect to Equation 1 above, xeR" denotes an actual 
aircraft state vector, ueR m denotes a control surface input 
vector, and ooeR 3 denotes an angular velocity vector. In one 
implementation, C contains zeroes and ones. Measurements 
of x and u are represented below in Equation 2. 25 

x™=x+bx, u m =u+bu (Equation 2) 

With respect to Equation 2 above, 6x and 8u denote any 
measurement errors based on flight measurement data from 
the flight measurement block 206 (the flight measurement 30 
data indicated as 6 and % in FIG. 3). In particular, sources of 
measurement error from the flight measurement block 206 
include sensor noise and sensor bias. Additional sources of 
measurement error include, without limitation, sensor drift, 
sensor dynamics, and sensor time delay. From the control 35 
surface positions and actual aircraft states provided by the 
flight measurement block 206, an estimated angular accelera- 
tion of the aircraft 1 04 is calculated in the aircraft model block 
314 as illustrated below in Equation 3. 


6) = Cf(xT, vT) 


(Equation 3) 


= -J 1 of 1 x Joj m + 

J~ l [Tpropix™, 0 + T aero (xT, U m )] 


With respect to Equation 3 above, J represents an estimate 
of the inertia matrix, x prop represents an estimate of the 
moments generated by the propulsion system of the aircraft 50 
104 about the center-of-gravity of the aircraft 104, and x aero 
represents an estimate of the aerodynamic moments about the 
center-of-gravity of the aircraft 104. In the example embodi- 
ment of FIG. 3, a value for measured angular acceleration 00™ 
results from differentiating oo m =Cx m as illustrated below in 55 
Equation 4. 


d?(CY") (Equation 4) 

0 ) = — 

dt 60 

_ d(Cx + CSx) 

~ dt 
= Co + 6(1) 

65 

With respect to Equation 4 above, 600 represents sensor 
noise. Taking the difference of the measured angular accel- 


eration of the aircraft 1 04 with the actual angular acceleration 
of the aircraft 104 results in the error signal e, as illustrated 
below in Equation 5. 


= 0)~co m (Equation 5) 

= 6) — to — 6(b 

= Cf{x + 6x+ 8u) - Cf(x, u ) - 6oj 


Subsequently, (x 0 , u 0 ) of Equation 5 is considered a trim 
condition of the aircraft 104 (that is, f(x 0 , u o )=0). Taking the 
Taylor series expansion of e about (x 0 , u 0 ) and keeping only 
first order terms results in the expression illustrated below 
with respect to Equation 6. 


e % Cf(x 0 + Sx, U p + 60)- + CAAAx + CABAu (Equation 6) 

trim and measurement errors model mismatch 

With respect to Equation 6 above, Ax=x-x 0 , Au=u-u 0 , 


AA = 


df(x + 8x, u + 8u) 
dx 


df( x, u) 
dx 


and 


A B 


df(x + 8x, u + 8u) 
du 


df( x, u) 
du 


The residual band pass filter 304 combines each error sig- 
nal e x to e 3 (once filtered) in the residual signal multiplexer 
324 to create the residual signal 332. The low pass filter 
function 320 removes one or more errors due to sensor noise 
and high-frequency un-modeled sensor dynamics (for 
example, aircraft flexure of the aircraft 104) in all three axes 
of motion. The high pass filter function 322 removes control 
surface trim and sensor bias errors in all three axes of motion. 

Fault Detection Error Threshold 

The threshold signal 330 is the tightly bound upper limit of 
the one or more potential differences between the at least 
three reference commands r x to r 3 and the at least three error 
signals e l to e 3 . When the comparator function 328 deter- 
mines the residual signal 332 is greater than or equal to the 
threshold signal 330, the fault signal 334 indicates that a fault 
has been detected. In one implementation, the fault signal 334 
equals one when the fault is detected. When the fault signal 
334 is equal to one, the fault detection module 300 (the fault 
detection block 210) informs the fault isolation block 209 of 
FIG. 2 to estimate a change in (AM**) as discussed above 
with respect to FIG. 2. When the aircraft 104 of FIG. 1 does 
not experience any faults, the residual signal 332 is less than 
the threshold signal 330. 

For each reference command r received from the flight 
command block 204 of FIG. 2, an upper bound is derived in 
the threshold function 302. The upper bound limits a model- 
ing mismatch between estimated (that is, predictions made by 
the one or more reference commands r) and the non-faulted, 
actual aircraft states (for example, angular acceleration) from 
the aircraft model block 314. The threshold function 302 
tightly bounds the size of the modeling mismatch in order to 
minimize the number of false alarms (that is, flagging a fault 



US 8,209,083 B2 


that has not occurred) and the number of missed detections 
(that is, not flagging a fault when one has occurred). 

The threshold function 302 represents an upper bound of a 
linear time-invariant transfer matrix G(s) of the at least three 
reference commands r x to r 3 to the residual signal 332. An 
impulse response of G(s) is denoted by g(t), and g z (t) denotes 
an \ th row of G(s). An \ th element of e is illustrated below in 
Equation 7. 


10 


?iw= JT- 


(r)r(t-r)dr 


(Equation 7) 


An upper bound for le z (t)l is derived as illustrated below in 15 
Equation 8. 


(Equation 8) 


15/ (01 = |J^ gi{r)r{t-r)d^ < 

J' \gi(r)r(t-T)\dr< I \'\gij(r)r J 

Jo jZ i 


j{t-T) | 


ir 

Vj 


equal to \e t {t)\ when 
(t-r) = sgn[gj(r)], Vr<f 


choose Fij(s) with ^ \gij(r)\ 
j= l 

3 

\ r j(t ~ r )l - ^ fij( T )\ r j(* ~ r)|, Vr<f 


JV 


y(r)\rj(t - T)\dr 


20 


30 


35 


The threshold function 302 for ? z (f) 


With respect to Equation 8 above, the threshold function 40 
302 for e z (t) is graphically depicted in FIG. 3 as the absolute 
measurement functions 306 1 to 306 3 , the threshold filter func- 
tions 308 1 to 308 3 , and the threshold signal multiplexer 326. 
The threshold filter functions 308 1 to 308 3 (represented as 
first-order filters F ..(s) in Equation 9 below) tightly bounds 45 
le z (t)l . A mathematical model of the first-order filters F zz (s) is 
illustrated below with respect to Equation 9. 


8 

In the example embodiment of FIG. 3, each of the threshold 
filter functions 308 1 to 308 3 classify every flight command 
dataset (from the at least three reference commands r x to r 3 ) 
using Statistical Learning Theory (SLT). Alternate classifica- 
tion methods are possible. SLT allows the threshold function 
302 to learn a classifier function y =f(x) that will correctly 
classify unseen fault examples (that is, fault samples) as an 
expected risk. The expected risk measures performance of a 
candidate solution f as illustrated below in Equation 10. 

R\f\=jL(f(x),y)dP(x,y) (Equation 10) 

With respect to Equation 1 0 above, R is the risk functional 
ranging over 

[0, 1], P(x, y) represents a probability density function (PDF) 
of the filter gains k, of the threshold filter functions 308 (x) 
and the sensor bias from the bias model blocks 310 (y), and L 
is the loss function defined as illustrated below with respect to 
Equation 1 1 . 


um,y) = 0 if f(x) = y 
= 1 if f{x)ty 


(Equation 11) 


Along with calculating the expected risk, a risk over each 
of the flight command datasets, or an empirical risk, is deter- 
mined as illustrated below in Equation 12. 


1 n (Equation 12) 

R emP m = jjY J L{ f {x 'T y>) 


In one implementation, an empirical risk minimization 
(ERM) controls complexity (that is, capacity) of the function 
f of Equation 12 above. In one implementation, the classifier 
function uses a Vapnik-Chervonenkis (VC) dimension to 
measure complexity. The VC dimension of the classifier f 
measures the largest number of examples which can be mod- 
eled by a family of f. The VC dimension of the function f 
bounds the expected risk of Equation 10 as a function of the 
empirical risk of Equation 12 and a number of available 
examples. Moreover, a probability (1— r|) illustrates that the 
expected risk R[ f] of classification by the function j 1 is upper- 
bounded by the sum of the empirical risk R em/5 [f]and a VC 
confidence function as illustrated in Equation 1 3 below. 


Fa(s) = 


ki 

T t s + 1 


, with ki, Tj e R 


(Equation 9) ^ 


R[f] ^ RempU 1 + 



(Equation 13) 


Tunable Aircraft Fault Detection 


In one implementation, to achieve a particular balance 
between modeling uncertainty and the number of missed 
detections, T z = 2 seconds for all three axes with respect to 
Equation 9 above. The selection of filter gains k z (for the 60 
first-order filters F zz ), along with a suitable model of sensor 
bias from each of the bias model blocks 310, generates a fault 
detection classifier for each of the threshold filter functions 
308 1 to 308 3 . The fault detection classifier separates faulted 
flight data from non-faulted flight data for each axis of 65 
motion. The classification of faulted vs. non-faulted flight 
data results in a tunable threshold function 302. 


With respect to Equation 13, h is the VC dimension of f, N 
is the number of examples, and a second term on the right- 
hand side is the VC confidence function. To reduce the 
expected risk in classification, the classifier minimizes both 
the empirical risk and the VC confidence using Structural 
Risk Minimization (SRM). As the N/h term grows larger, the 
VC confidence term becomes smaller and the expected risk 
becomes closer to the empirical risk. For a fixed size of the 
dataset, the expected risk is reduced by reducing the VC 
dimension of the classifier. 

The bound on the expected risk is used to estimate a sample 
size within a prescribed confidence level (that is, the sample 
size guarantees a desired degree of confidence in the classi- 
fication results obtained by f). To estimate the sample size, € 
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represents an error tolerance between the estimated and 
empirical risks as illustrated below in Equation 14. 

P(swp(Rff]-R emp [f]) < e)>l-r\ (Equation 14) 

With respect to Equation 1 4 above, any classification based 5 
on f is (with a confidence of (1 -r|)) correct within a tolerance 
of €. Equation 15 is derived below based on Equations 13 and 
14 above. 


A ( log (ir) +1 )- 108 (s) 


(Equation 15) 
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yi[(w,Xi) + b] > 1, ie {1, 2, ... , N} 


|<w, xi ) + b\ 

p(w,b)= min — 4- 

Xi:yi =- 1 INI 


min 


\(w,Xi) + b\ 

INI 


1 

: iNi 

2 

: iNi 


min \{w,xi) + b\ + 
n-yi =- 1 

min \(w, xi) + b\ 

x r . yi =-i 


(Equation 20) 
(Equation 21) 


With the values of r\, € and h, the tlireshold function 302 
computes the size of each of the flight command datasets 
(represented as N) using Equation 1 5 . In the example embodi- 
ment of FIG. 3, one or more values are used for € and r\ (for 
example, of the order of 0.01-0.10). Moreover, using €=0.1, 
r|=0.01, and h=3 (a VC dimension for a 2-D hyperplane 
classifier), Equation 15 computes the lower bound on N as 
approximately 3200. Tighter bounds for values of € and r| 
reduce N by a substantial order of magnitude. In one imple- 
mentation, N (that is, the flight command dataset) is reduced 
by a factor of 18. 

In one implementation, a separating hyperplane substan- 
tially maximizes a margin (that is, the distance between the 
decision surface and the nearest data-point of each class) for 
the (linearly- separable) dataset from the viewpoint of SRM. 
A VC dimension of the separating hyperplane h with margin 
m bounded is illustrated below in Equation 16. 


{ r 2 \ (Equation 16) 

h < mini — , n + 1 

\ m ) 


Optimizing the dataset of each of the threshold filter func- 
tions 308^0 308 3 is illustrated below in Equations 22 and 23. 


20 


maxmin<D(w, b, a), where 


(Equation 22) 


1 N 

<J>(w, b,a)= - HI 2 - ^ <*/0'i[<w. x i > + b]-l 


(Equation 23) 


With respect to Equation 23 above, cx z are Lagrangian mul- 
tipliers with 0^=0. Casting Equation 23 as a quadratic pro- 
gramming (QP) problem using a dual formulation is illus- 
trated below in Equation 24. 


30 


w* 



aiyiXi 


(Equation 24) 


35 


1 

b * + 


With respect to Equation 1 6 above, n is the dimensionality 
of the input space, and R is the radius of the smallest hyper- 
sphere containing all the input vectors. The fault detection 
module 300 substantially maximizes the margin m to sub- 
stantially minimize the VC dimension of the separating 
hyperplane. In one implementation, the separating hyper- 
plane has substantially no empirical error (that is, the sepa- 
rating hyperplane correctly separates the dataset). By cor- 
rectly separating each flight command dataset into faulted 
and non- faulted responses, the maigin is substantially maxi- 
mized and the upper bound on the expected risk is substan- 
tially minimized (that is, the fault detection classifier provides 
a statistical guarantee that the threshold function 302 will 
correctly identity faulted and non-faulted flight data). 

In one implementation, in order to correctly separate the 
reference command dataset, the separating hyperplane 
involves separating a set of training vectors belonging to two 
separate classes as illustrated below in Equation 17, with a 
hyperplane as illustrated below in Equation 18. 

yi), (x 2 , y 2 ), ■ ■ ■ , ( X N, ;V)}, xeR n , ye{- 1,1 } (Equation 17) 

{ w,x )+ -b =0 (Equation 1 8) 

In one implementation, the fault detection module 300 
includes a canonical hyperplane where the parameters w (rep- 
resenting the filter gains k z of the threshold functions 308) and 
b (representing the sensor bias of the bias model blocks 310) 
are constrained as illustrated below in Equation 19. 

min, 1 { w,x )±b I = 1 (Equation 1 9) 

An optimal separating hyperplane must satisfy the follow- 
ing constraints as illustrated below in Equation 20, with a 
margin given as illustrated in Equation 21 . 


In one implementation, and with respect to Equation 24 
above, x r represents a support vector from each class (that is, 
fault and non-fault data) of the flight command dataset, and x s 
represents a support vector from each class of the sensor bias 
readings that both satisfy Equation 25 as illustrated below. 

a r ,a s X),f=-l,f=l (Equation 25) 

With respect to Equation 25 above, a classifier function for 
45 the support vectors x r and x s is illustrated below in Equation 
26. 

f(x)=sgn({w*,x)+b*) (Equation 26) 

With respect to Equation 26 above, w*(a vector of size 3) 
50 represents the optimal gains k z for each of the threshold filter 
functions 308 : to 308 3 , and b*(a vector of size 3) represents 
the optimal bias for each of the bias model blocks 310! to 
310 3 . The support vectors x r and x s classify the faulted and 
non-faulted flight command data in each of the threshold filter 
55 functions 308, to 308 3 . The fault detection classifier trains 
(that is, tunes) the threshold function 3 02 to optimally classify 
the faulted and non-faulted flight data and ignore the non- 
faulted data. 

While the methods and techniques described here have 
been described in the context of a fully-functioning simulated 
60 aircraft fault detection system, apparatus embodying these 
techniques are capable of being distributed in the form of a 
computer readable medium of instructions and a variety of 
forms that apply equally regardless of the particular type of 
signal bearing media actually used to carry out the distribu- 
65 tion. Examples of computer readable media include record- 
able-type media, such as a portable memory device, a hard 
disk drive, a RAM, CD-ROMs, DVD-ROMs; and transmis- 
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sion-type media, such as digital and analog communications 
links, wired or wireless communications links using trans- 
mission forms such as, for example, radio frequency and light 
wave transmissions. The computer readable media may take 
the form of coded formats that are decoded for actual use in an 
aircraft flight system, including flight system 100 of FIG. 1. 

What is claimed is: 

1. A method for detecting faults in an aircraft, the method 
comprising: 

in a programmable processor: 

predicting at least one state of the aircraft; 
processing corresponding actual, non-faulted aircraft 
state and a faulty aircraft state to at least one bias value 
and at one threshold filter function; 
generating at least one threshold value based on a first 
reference command signal; 

tuning the at least one threshold value to upper bound the 
size of a mismatch between the at least one predicted 
state and the corresponding actual state based on the 
at least one bias value and the at least one threshold 
filter function; and 

if the mismatch between the at least one predicted state 
and the corresponding actual state is greater than or 
equal to the at least one threshold value, indicating 
that at least one fault has been detected. 

2. The method of claim 1, wherein predicting the at least 
one state further comprises estimating angular acceleration of 
the aircraft. 

3. The method of claim 1, further comprising classifying 
the faulted flight data from the non-faulted flight data for each 
axis of motion. 

4. The method of claim 3, wherein the at least one threshold 
filter function and the at least one bias value statistically 
guarantee the classification of the faulted and non-faulted 
flight data within a prescribed confidence level. 

5. The method of claim 1, wherein indicating that the at 
least one fault has been detected further comprises notifying 
a display on a flight deck of the aircraft upon successful 
detection of the at least one fault. 

6. The method of claim 1, wherein tuning the at least one 
threshold value to upper bound the size of a mismatch further 
comprises: 

filtering an absolute value of the first reference command 
signal with the at least one threshold filter function to 
generate a filtered reference command signal; and 

adding the at least one bias value to the filtered reference 
command signal. 

7. The method of claim 1, wherein the at least one threshold 
filter function comprises a filter gain. 

8. A method for detecting faults in an aircraft, the method 
comprising: 

in a programmable processor: 

predicting at least one aircraft state based on responses 
from flight measurement data; 
calculating a difference between the predicted aircraft 
state and a corresponding measured state of the air- 
craft; 

processing a corresponding actual, non-faulted aircraft 
state and a faulty aircraft state to calculate at least one 
filter gain and at least one bias value; 
determining a threshold of an upper bound for the dif- 
ference between the predicted aircraft state and the 
corresponding measured state based on the at least 
one bias value and the at least one filter gain; 
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comparing the threshold with the difference between the 
predicted aircraft state and the corresponding mea- 
sured state; and 

if the difference is greater than or equal to the threshold, 
indicating that at least one fault has been detected. 

9. The method of claim 8, wherein predicting the at least 
one aircraft state comprises estimating operational behavior 
of the aircraft in a non-fault state in response to one or more 
reference commands. 

10. The method of claim 8, wherein calculating the differ- 

io ence fiirther comprises deriving the corresponding measured 

state from actual flight measurement data. 

1 1 . The method of claim 8 , wherein determining the thresh- 
old further comprises: 

classifying faulted and non-faulted flight measurement 

15 data; and 

ignoring the non-faulted flight measurement data. 

12. The method of claim 11, further comprising calculating 
the at least one filter gain and the at least one bias value that 
statistically guarantees the classification of the faulted and 
non-faulted flight measurement data within a prescribed con- 
fidence level. 

13. The method of claim 8, wherein indicating further 
comprises notifying a flight deck control display with a status 
and potential impact of the at least one detected fault on the 
aircraft. 

25 14. The method of claim 8 , wherein determining the thresh- 

old further comprises wherein the threshold is based on a first 
reference command signal. 

15. The method of claim 14, wherein determining the 
threshold further comprises filtering an absolute value of the 

30 first reference command signal with the at least one filter gain 
and adding the at least one bias value. 

16. A method for detecting a fault in an aircraft, compris- 
ing: 

in a programmable processor: 

35 generating a threshold signal based on at least one bias 
value added to a reference command signal filtered by 
at least one threshold filter function; 
generating a residual signal based on a band passed 
filtered error function, wherein the band passed fil- 
tered error function is based on the difference between 
a measured state of the aircraft and a corresponding 
estimated state; 

comparing the threshold signal and the residual signal; 
tuning the threshold signal based on processing a corre- 
sponding actual, non-faulted aircraft state and a 

45 faulted aircraft state to compute the at least one bias 

value and at least one threshold filter function; and 
indicating that at least one fault is detected when the 
residual signal is equal to or greater than the threshold 
signal. 

50 17. The method of claim 16, wherein tuning the threshold 

signal further comprises classifying faulted flight data from 
non-faulted flight data for each axis of motion. 

18. The method of claim 17, wherein classifying faulted 
flight data from non-faulted flight data for each axis of motion 

55 further comprises calculating at least one threshold filter 
function and at least one bias value that statistically guaran- 
tees the classification of the faulted and non-faulted flight data 
within a prescribed confidence level. 

19. The method of claim 16, wherein indicating further 
comprises displaying a notification on a flight deck of the 

60 aircraft. 





